Description

A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. This issue affects Junos OS on MX Series: * All versions before 21.2R3-S11; * from 21.4 before 21.4R3-S12; * from 22.2 before 22.2R3-S8; * from 22.3 before 22.3R3-S5; * from 22.4 before 22.4R3-S9;

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T17:18:06.080Z",
  "pubdate": "2026-10-14T17:18:06.080Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists within the kmd component of Juniper Networks Junos OS on MX Series platforms.\nThis vulnerability allows an unauthenticated, remote network attacker to achieve arbitrary code execution with root-level privileges.\nThe flaw is triggered through the processing of specially crafted IKE (Internet Key Exchange) certificate-based packets, making the device highly susceptible to compromise without requiring prior authentication.\nGiven the nature of the kmd component, which handles security and VPN cryptographic operations, the successful exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the entire network node.\nBecause the attacker executes code as the root user, full system control is achieved, potentially allowing for lateral movement within the network, traffic interception, or persistent installation of unauthorized firmware.\nThe vulnerability affects multiple releases across several Junos OS branches, necessitating immediate patching to secure the control plane of the affected MX Series routers.",
  "technicalDetails": "The vulnerability originates in the kmd (Key Management Daemon) component of Junos OS, which is responsible for IKE and IPsec key management processes. The root cause is a stack-based buffer overflow condition triggered during the parsing or validation of malformed IKE certificate-based payloads.\nWhen the kmd component receives a crafted IKE packet, the memory management logic fails to properly validate the bounds of incoming certificate data before copying it into a fixed-length stack buffer. This lack of input sanitization leads to memory corruption, where the excess data overwrites adjacent memory locations on the execution stack.\nBy carefully crafting the malicious packet, an attacker can overwrite the saved return address or other critical control structures on the stack. Upon completion of the function call, the process execution flow is hijacked, redirecting the instruction pointer to attacker-supplied shellcode or utilizing ROP (Return-Oriented Programming) chains to execute arbitrary commands.\nThe attack flow follows these steps: 1) The attacker sends a specifically engineered IKE certificate-based packet to the target MX Series device. 2) The kmd component intercepts and initiates the parsing of the certificate fields within the packet. 3) The overly long certificate payload exceeds the allocated stack buffer during the copy operation. 4) The stack overflow results in the corruption of the function's return pointer. 5) Execution of the payload occurs with the elevated privileges of the kmd process, which operates as root.\nAffected versions include all Junos OS releases on MX Series prior to 21.2R3-S11, 21.4R3-S12, 22.2R3-S8, 22.3R3-S5, and 22.4R3-S9. As the kmd component listens for network traffic to establish secure tunnels, the vulnerability is exposed to any network entity capable of reaching the device's IKE interface. Because the vulnerability can be triggered via unauthenticated remote packets, no session initiation or login credentials are required to carry out the exploit, significantly increasing the risk profile for Internet-facing routers."
}